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Abstract 

We describe an algorithm to compute Grobner bases which combines F4-style reduction with the F5 criteria. 
Both F4 and F5 originate in the work of Jean- Charles Faugere [Fau99, Fau02], who has successfully computed 
many Grobner bases that were previously considered intractable. Another description of a similar algorithm 
already exists in Gwenole Ars' dissertation [Ars05]; unfortunately, this is only available in French, and although 
an implementation exists, it is not made available for study. We not only describe the algorithm, we also direct 
the reader to a study implementation for the free and open source Sage computer algebra system [S^08]. We 
conclude with a short discussion of how the approach described here compares and contrasts with that of Ars' 
dissertation. 



1 Introduction 

This work describes and discusses Jean-Charles Faugere's Fr, algorithm. However, instead of presenting _F'5 in the 
"traditional" fashion as is done in [Fau02, Stc05, Gas08], a variant of F5 in F4- "style" is presented. We refer to this 
variant as -F4/5. The main differences between i^4/5 and F5 are: 

• The two outermost loops are swapped (cf. [Fau07]), such that Algorithm 1 proceeds by degrees first and then 
by index of generators. proceeds by index of generators first and then by degrees. 

• The polynomial reduction routines are replaced by linear algebra quite similar to matrix-i^5 (cf. [BFS03, 
FA04]). 

• The lists Rulesi are kept sorted at all times, which matches matrix- i% closer and seems to improve performance 
slightly. 

• Polynomial indices are reversed in Algorithm 1 compared to [Fau02]. That is, we compute the Grobner basis 
for the ideal (/o) first and not for the ideal (/„i_i). 

A study implementation of Algorithm 1 for Sage is available at 

http : / /bitbucket . org/malb/algebraic_attacks/src/tip/f 5_2 .py 

and a study implementation of Fr^ proper and variants is available at 

http : //bitbucket . org/malb/algebraic_attacks/src/tip/f 5 .py. 

2 Background material 

Let TZ = F[a;o, . . . , Xn-i] be a polynomial ring over the field F. The goal of any i^s-class algorithm (including F^/^) 
is to compute a Grobner basis of /o, . . . , /m-i € Ti- with respect to a given monomial ordering. 

The distinguishing feature of F^ is that it records part of a representation of each polynomial (or row) in terms of 
the input. This record is kept in a so-called signature. 



Definition 2.1 (Signature). Let P™ be the free module over TZ and let be a canonical unit vector in P™; 

= (0, . . . , 0, 1, 0, . . . , 0) where the 1 is in the i-th position. A signature is any product a = t ■ e^, where t is a 
monomial in xq, ■ ■ ■ , Xn-i- We denote by S the set of all signatures. 

We extend the monomial ordering on 7?. to 5. 

Definition 2.2. Let tei and uej be signatures, we say that tei > uej if 

• i > j or 

• i = j and t > u. 

To eacli polynomial we associate a signature; this pair is called a labelled polynomial. We are interested only in 
associating signatures with polynomials in a specific way. 

Definition 2.3 (Labelled Polynomial). Let a G S and f eTZ. We say that {cr,f) is a labelled polynomial. In 

addition, we say that (ct, /) is admissible if there exist hg, . . . , hm-i G Ti- such that 

• / = hofo + • • • + fm-lhm-l, 

• /li+i = ■ • ■ = h„i-i = 0, and 

• cr = LM{hi)ei. 

The following properties of admissible polynomials are trivial. 

Proposition 2.1. Let t,u,v be monomials and f,g G TZ. Assume that (lie^,/) and {vej,g) are admissible. Each 
of the following holds. 

(A) {tuei,tf) is admissible. 

(B) If i > j, then [uQi, f + g) is admissible. 

(C) If i ~ j and u > v, then (uei, f + g) is admissible. 

fn light of this fact, we can define the product of a monomial and a signature in a natural way. Let t, u be monomials 
and a £ S such that a = uei for some i G N. Then 

t ■ a ~ tuGi. 

Whenever P5 creates a labelled polynomial, it adds it to the global list L. Instead of passing around labelled 
polynomials, indices of L are passed to subroutines. We thus identify a labelled polynomial r with the natural 
number i such that Li = r. The algorithm's correctness and behaviour depends crucially on the assumption that 
all elements of L arc admissible. Thus all P5-class algorithms ensure that this is the case at all times. 

Notation 2.2. Let r £ L and write r ~ {t ■ ei,p). We write 

• poly(r) = p, 

• sig(r) = t ■ Bi, and 

• idx(r) i. 

Definition 2.4. Let a,5 G N and suppose that sig(a) = uBi and sig(6) = vbj. Let ta ~ LM(poly(a)), tf, = 
LM(poly(6)), and 

aa,b = LCM(<a,4)Aa. 

// (Ta,6sig(a) > (Tb.aSig(6) then the naturally inferred signature of the S-polynomial S of poly(a) and poly(6) is 

CTa.b ■ UBi. 
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From (B) and (C) above we can see that {da^b ■ ue.i, S) is admissible if a and b are admissible. 
The following is proved in [EPIO]. 

Proposition 2.3. Let i, fc e N. Let ho, . . . , hm-i G TZ such that hij^i = . . . = hm-i = and sig(fc) = LM{hi)ei. 
sig(A:) is not the minimal signature o/poly(fc) if and only if there exists a syzygy (zq, . . . , Zm-i) G P™ 0//0, . . . , fm~i 
such that 

• sig(fc) is a signature of zofo-] ^m-i/m-i/ 

• if tBj is the minimal signature o/poly(fc), then hk — z^ = for all k > j and LM(ft,j — Zj) = t. 

From this proposition it follows that we only need to consider S-polynomials with minimal signatures. 

Suppose that all syzygies of F are generated by trivial syzygies of the form fiej — fjGi. If s\g{k) is not minimal, then 
some multiple of a principal syzygy m{fiej — fj^i) has the same signature sig(fc). This provides an easy test for 
such a non-minimal signature and thus reductions to zero. Since all syzygies are in the module of trivial syzygies, 
the signature must be a multiple of the leading monomial of a polynomial already in the basis. 

Theorem 2.4 {F^ Criterion). An S-polynomial with signature tei is redundant and can be discarded if there exists 
some g with idx(g) < i such that hM(g) \ t. 

Another application of the signatures consists in "rewrite rules" . 
Definition 2.5. A rule is any (cr, fc) G iS x N such that a — sig(fc). 

The algorithm uses a global variable. Rules, which is a list of m lists of rules. We can view the elements of any 
Rulesi in two ways. 

• Each element of Rulesi designates a "canonical reductor" for certain monomials, in the following sense. Let 
/)ffij52 6 TZ and assume that LM((7i), LM(52) | LM(/) and idx(/) ~ idx(gi) = idx(g2)- In a traditional 
algorithm to compute a Grobner basis, the choice of whether to reduce / by gi or by (72 is ambiguous, and 
either may be done. In F^ class algorithms, by contrast, there is no such choice! One must reduce LM(/) by 
exactly one of the two, depending on which appears later in Rulesi. A similar technique is used by involutive 
methods to compute Grobner bases [GB98]. For both methods, the restriction to one canonical reductor 
appears to improve performance dramatically. 

• Each element of Rulesi corresponds to a "simplification rule" ; that is, a linear dependency already discovered. 
From the "polynomial" perspective, (tr, k) G Rulesi only if either fc < to or there exist a, 6 G N, hj G 72,, and 
monomials t, u such that 

— S was first computed as the S'-polynomial t ■ poly(a) — u ■ poly(6) of poly (a) and poly(6); 

— S = J2j^k ■ Poly(j) + poly(fc) with LM(ft.jpoly(j)) < LM(S') for each j; and 

— (T = sig(fc) is the naturally inferred signature of S. 

In matrix- i^5, instead of starting from scratch from the original fi for each degree d, the matrix 
is used to construct the matrix ^^'=""'"2' order to re-use the linear dependencies discovered at degree 
d — 1. The same task is accomplished by the set of simplification rules in Rulesi, but instead of computing 
all multiples of the elements in Rulesi we merely use it as a lookup table to replace a potential polynomial 
by an clement from L where reductions by smaller signatures were already performed. 

Strictly speaking, any rule is somewhat redundant: if (a, k) G Rulesi then we know that a — tei for some monomial 
t. Hence it is sensible to store only t rather than a. 

3 Pseudocode 

We can now define the main loop of the F5 algorithm (cf. Algorithm 1). This is similar to the main loop of F4 
except that: 
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• for each input polynomial fi we create the labelled polynomial (1 • ei,LC(/i) ^ ■ /,;), which is obviously 
admissible; and 

• for each computed polynomial /,;, the rule (sig(i),i) is added to Rulesidx{i)- 

Input: F - a list of homogeneous polynomials /o, . . . , fm-i 

Result: a Grobner basis for F 

begin 

sort F by total degree; 
L,G,P^ [],0,a; 
for < i < m do 

append (1 • ei,LC{fi)~^ ■ fi) to L; 
Add Rule(1 • e,, i); 

P ^ PU{UPDATEf5(*,J, G) : e G}; 
add i to G; 

while P ^ do 





- the minimal degree in P; 


Pd ^ 


— all pairs with degree d; 


p ^ 


-P\Pd; 


s ^ 


- S-POLYNOMIALSF5(-Pd); 




- Reductionf5(S', G); 



for i E S do 

P ^ PU{UPDATEj.5(i,J, G) : Vj e G}; 
add i to G; 

_ return {poly(/) | V/ G G}; 

Algorithm 1: F4/5 

The subroutine UPDATEi?5 constructs a new critical pair for two labelled polynomials indexed in L. A critical pair 
in Fq is represented the same way as a critical pair in F4, except that the polynomials are replaced by indices to 
labelled polynomials. 

Just like the routine Update in F4 imposes the Buchbcrgcr criteria, UPDATEi?5 imposes the F5 criteria. These 
checks are: 

• Make sure that the multipliers that give rise to the components of the S-polynomial are not in the leading 
monomial ideal spanned by the leading monomials of the polynomials with index smaller than the S-polynomial 
component. This would imply that the natural signature which the algorithm would assign to the S-polynomial 
is not the minimal signature, and can be discarded by the P5 criterion. 

• Check whether a rule forbids generating one component of the S-polynomial. This has the same purpose as 
reusing fop j^amuiay matrix- i^s. If a component w-r of the S-polynomial is rewritable, this means 
that there is an element which can replace it which has probably had more reductions applied to it already. 
The element that rewrites the rewritable component was either already considered or will be considered in 
the future. Thus this avoids re-computation of the same linear combinations. 

• Ensure that the signature of the resulting S-polynomial is the one that we would infer naturally. This should 
be the larger signature of the components; that is, that the labelled polynomial remains admissible. 

The routine S-PolynomialSfs first checks the rewritable criterion again, in case new elements have been created 
which would rewrite a component after creation of the critical pair. Then it computes the actual S-polynomials 
in such a way that only the part is computed which gives rise to the new signature. The subtraction of the other 
component and thus the cancellation of leading terms is delayed to the reduction routine. Indeed, S-PolynomialSf5 
discards the component {v,l) and relies on Symbolic PreprocessinGfs to find a reductor for u ■ poly(Z). We 
delay the rationale for this until the discussion of that algorithm; see below. 

The routine Add Rule simply adds an entry to the list Rulesi encoding that the signature a corresponds to the 
labelled polynomial k. Note, however, that F4/5 sorts the list Rulesi by while other versions of F5 simply append 



4 



Input: fc ~ an integer < fc < |L| 
Input: / - an integer < / 7^ /c < |L| 

Input: G - a list of integers with elements e such that < e < |L| 
Result: the critical pair for poly(fc) and poly(Z), iff the F5 criteria pass, 
begin 

tu.ti ^ LT(poly(fc)),LT(poly(/)); 
LCM(tfe,tO; 

MfcjU; < — t/tk,t/ti; 

(mfc, efc), {mi,ei) < — sig(fc), sig(0; 

if TOP-REDUClBLE(wfc • mfc, {gi G G: idx(,g.i) < efe}) then 
1^ return; 

if TOP-REDUClBLE(ui • mi, {g^ G G: idx{g^) < ej) then 
|_ return; 

if Rewritable fufe, fc J or Rewritable fu/, then 
1^ return; 

if Uk ■ sig(fc) < ui ■ sig(Z) then 
swap Uk and ui; 
swap k and I; 

_ return {t,Uk,k,ui,l); 

Algorithm 2: UPDATEi;'5 



Input: P - a list of critical pairs 
Result : a list of S-polynomials 
begin 

S ^0; 

sort P by increasing signature; 
for {t, u, fc, v,l) € P do 

if Rewritable(u, fc) or REWRiTABLE(t;, then 
1^ continue; 

add (m, fc) to 5; 

sort 5 by signatures; 
return S; 

Algorithm 3: S-PolynomialSf5 
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new rules at the end of the list. The latter approach ensures that Rulesi is sorted by degree of but it does not 
necessarily impose an ordering w.r.t. to the monomial ordering on Rulest. 

Input: (7 -a signature 

Input: k - an integer < fc < \L\ 

begin 

let t, i be such that t • = cr; 

insert {t, k) into Rulesi such that the order on t is preserved; 

Algorithm 4: Add Rule 

The routine Rewritable determines whether u ■ sig(fc) is rewritable, as outlined in the Section 2. 

Input: u - a monomial 

Input: k - an integer < fc < \L\ 

Result: true iff u ■ sig(fc) is rewritable 

begin 

let i, i be such that t • e^ = sig(fc); 
for \Rulesi\ > ctr > do 

(^^li) ^ — Rulesi[ctr]; 

if w I {u ■ t) then 
1^ return j k; 

return false; 

Algorithm 5: Rewritable 

Input: t - a. monomial 

Input: G - a set of indices in L 

Result: true iff t is top- reducible by any element in G 
begin 

for g e G do 

if LM(poly(g)) I t then 
|_ return true; 

return false; 

Algorithm 6: Top-REDUCIBLE 

Algorithm REDUCTlONi?5 organises the reduction of the S-polynomials. It first calls Symbolic Preprocess- 
iNGi?5 to determine which monomials and which polynomial multiples might be encountered while reducing the 
S-polynomials. The resulting list of polynomial multiples is sorted in decreasing order of their signatures, in order 
to avoid reducing a polynomial by another with a larger signature (a phenomenon called "signature corruption" 
which has catastrophic consequences on the computation of the basis). Reduction then calls Gaussian Elimina- 
TiONi?5, which transforms the list of polynomials into a matrix, performs Gaussian elimination without swapping 
rows or columns, then extracts the polynomials from the matrix. "New" polynomials in the system are identified 
by the fact that their leading monomials have changed from that of the polynomials in F: that is, a reduction 
of the leading monomial took place. We add each new polynomial to the system, and create a new rule for this 
polynomial. 

Sometimes, a reductor has signature larger than the polynomial that it would reduce. To avoid signature corrup- 
tion, class algorithms consider this as another S-polynomial, and as a consequence generate a new polynomial. 
However, Symbolic PreprocessinGfs cannot know beforehand whether this new polynomial is indeed necessary, 
so it docs not generate a new rule, nor add it to L. This is done in Reduction^^s. 

The routine Find Reductor tries to find a reductor for a monomial m with signature a in G. After checking 
the normal top reduction criterion it applies the same criteria to t • as Updatej^s applies to the components of 
each S-polynomial. However, we have added another check that does not appear in traditional pseudocode for F5: 
whether u ■ LM(poly(A:)) S F. 
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Input: S* - a list of S-polynomials indexed in L 
Input: G - a list of polynomials indexed in L 
Result: the top- reduced set S 
begin 

F, T < — Symbolic PreprocessingfsIS", G); 
F i — Gaussian Elimination's (i^, T) ; 
F+ < — 0; 
for < fc < |F| do 

{u,i) < — Fk] 

(J < — sig(«); 

if u ■ LM(poly(i)) = LM(Ffc) then 
1^ continue; 

append {ua,p) to L; II Create new entry 
Add Rule(u(t, \L\ - 1); 
if p ^ then 
|_ add i to F+; 

return F+; 

Algorithm 7: Reductionfs 



Input: S - a. list of components of S-polynomials 
Input: G - a list of polynomials indexed in L 

Result: F - list of labelled polynomials that might be used during reduction of the S-polynomials of S 
begin 

F 

Done < — 0; 

let M' be the monomials of {poly(A:) | Vfc g F}; 
while M' ^ Done do 

let m be maximal in M' \ Done; 

add m to Done; 

let a be minimal in {sig(fc) \ k Cz F and m is a monomial of poly(fc)}; 
t,k< — Find Reductor(to, ct, G, F); 
ift^O then 

append {t, k) to F; 

add the monomials of t ■ poly(A:) to M'; 

sort F by decreasing signature; 
return F, Done 

Algorithm 8: Symbolic Preprocessing 
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Input: m - a monomial 

Input: G - a list of polynomials indexed in L 

Input: F ~ a list of primary generators of S'-polynomials 

begin 

for fc e G do 

if LM(poly(fc)) \m then 
1^ continue; 

u < — 7n/LM(poly(A:)); 
if {u, k) e F then 
|_ continue; 

let t ■ e,; be sig(fc); 

if Top-REDUCIBLe(m -t, {g £ G \ idx(,9) < i}) then 
L continue 

if Rewritable(m, fc) then 
|_ continue; 
return u, k 
return 0,-1 

Algorithm 9: Find Reductor 

This returns us to a topic alluded to in the discussion of S-PolynomialSf5- Recall that, in S-P0LYN0MIALSf5, we 
deferred the construction of w-poly(/). In most cases, there will be a choice of reductors for u-poly(fc); hypothetically, 
V ■ poly(Z) might not be the choice of Symbolic PreprocessinGfs- This would imply that the S'-polynomial of 
poly(fc) and poly(^) might not be computed, even though it is necessary. In fact, this cannot happen! By way 
of contradiction, suppose that Find Reductor chooses {t,j) to reduce (u, fc) and {v,l) is not used to build the 
matrix: then 

LCM(LM(poly(j)),LM(poly(0)) < LCM(LM(poly(fc)), LM(poly(0)). 

Since the algorithm proceeds by ascending degree, it must also be considering the critical pair for poly(j') and 
poly(^), if it did not do so at a lower degree. We consider two cases. 

• Suppose that the algorithm rejected a generator of the S'-polynomial of poly(j) and poly(/); the criteria would 
clearly reject multiples of these generators as well. This leads to a contradiction: either Rewritable would 
have rejected v ■ poly(Z), so that S-PolynomialSf5 would not have computed the S'-polynomial of poly(fc) 
and poly(Z), or Find ReductoRfs would have rejected t ■ poly(j) as a reductor. 

• Suppose instead that the S-polynomial of poly(j) and poly(Z) either has been computed, or is being computed 
at this degree. These two possibilities also lead to a contradiction. 

— If it is being computed at this degree, then one of (t,j) or {v,l) already appears in F. If {t,j) appears, 
then the second if statement of Find Reductor precludes it from selecting {t, fc) as a reductor of [u, fc) 
instead of {v,l). 

— If, on the other hand, the S'-polynomial of poly(j) and poly(^) was computed at a lower degree, then 
the new polynomial would have a signature that rewrites one of t ■ poly(j) or v ■ poly(l) — so that the 
algorithm either cannot select (t,j) as a reductor, or it deems v ■ poly(^) rewritable, which means that it 
does not compute the S-polynomial of poly(fc) and poly(^)! 

The only way to avoid a contradiction is for the algorithm to include v ■ poly(^) in the matrix: either because it is 
already in the matrix, or because it is selected as a reductor of u ■ poly(fc). Therefore, the reformulated pseudocode 
does in fact compute all necessary S'-polynomials. 

The algorithm Gaussian Elimination's constructs a matrix A whose entries correspond to the coefficient of 
the jth monomial of the ith product listed in the input F. Subsequently, Gaussian EuiMiNATiONi^s computes a 
row-echelon reduction of the matrix, but in a straitjacketed sense: to respect the monomial ordering, we cannot 
swap columns, and to respect the signatures, we cannot swap rows, nor can we reduce lower rows (which have 
smaller signatures) by higher rows (which have larger signatures). As a result, each non-zero row has a unique 
pivot, but the appearance of the resulting matrix may not, in fact, be triangular. This is also why we must reset 



8 



the index i after any successful reduction to the top of the matrix, in case rows of higher signature can be reduced 
by the new row. 

Finally, GAUSSIAN ELiMlNATlONp-s returns a list of polynomials corresponding to the rows of the matrix A. Strictly 
speaking, there is no need to expand those polynomials of F whose leading monomials have not changed, since 
REDUCTiONi?5 will discard them anyway. Thus, a natural optimisation would be to return the matrix A to Reduc- 
tion i?5 , determine in that procedure which rows of the matrix need to be expanded, and expand only them. We 
have chosen to expand all of A in the pseudocode in order to encapsulate the matrix entirely within this procedure. 



a list of pairs (u, k) indicating that the product u ■ 
a list of all the monomials in F 
- a list of labelled polynomials 



is the coefficient of Tj in Ui ■ poly(A:i) 



Input: F 
Input: T - 
Result: F 
begin 

m,n^ |F|,|r|; 
denote each Fi by {ui,ki); 
let A be the m x n matrix such that a. 
for < c < n do 
for < 7' < 7Ti do 
if arc then 

// Ensure that we are only reducing by leading terms 
if any a^i ^ | < z < c then continue; 
rescale the row r such that the entry arc is 1; 
for r-|-l<i<?Tido// clear below 
if fljc ^ then 

1^ eliminate the entry a^c using the row r; 
break; 



poly(A:) must be computed 



let = A • T 
return F 



1=0 ' * 



m — 1 



1=0 



Algorithm 10: GAUSSIAN ELiMiNATiONi^s 



4 Correctness 

Since F^/^ follows the general structure of Fj^ it is helpful to assert that F4 is correct. 
Lemma 4.1. When F4 terminates it returns a Grobner basis. 

Proof. See [Fau99]. 

However, in i*4/5 we apply the F^ criteria instead of Buchberger's criteria. Thus, we need to prove that these criteria 
do not discard any S-polynomial which would be needed for a Grobner basis computation. 

Lemma 4.2 ([EPIO]). Assume that the main loop of Algorithm 1 terminates with output G. Let Q — {po\y{g) \ 
g G G}. If every S-polynomial S of Q satisfies (A) or (B) where 

(A) S reduces to zero with respect to Q 

(B) a component u ■ poly(A:) of S satisfies 

(Bl) u ■ sig(fc) is not the minimal signature of u ■ poly(fc),- or 
(B2) u ■ sig(fc) is rewritable; 

then Q is a Grobner basis for (/o, . . . , fm~i). 
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Proof. See [EPIO]. There is one subtlety to be noted: here we order Rulesi by signature. An examination of the 
proof shows that this docs not pose any difficulty for correctness. 

The other main differences between Fi^ and -^4/5 is that wc apply a variant of Gaussian elimination in i^4/5 to 
perform the reduction. However, as shown below this does not affect the set of leading monomials. 

Lemma 4.3. Let F be a set of polynomials in P = ¥[xo, ■ ■ ■ ,a;„-i]. Let F be the result of Gaussian elimination 
and F' the result of Algorithm 10 (^GAUSSIAN Elimination_f5 j. We have that LM(F) = LM(/"). 

Proof. Assume for contradiction that there is an element f & F with LM(/) ^ LM(F'). This implies that there 
is a row r in the coefficient matrix of F corresponding to a polynomial g which would reduce to / in Gaussian 
elimination. Assume that this reduction is not allowed in Algorithm 10 because the necessary reductor is in a row 
r' below r. In that case Algorithm 10 will add the row r to the row r' (since r has smaller signature than r') and 
store the result in r' producing the same addition and cancellation of leading terms. Thus only the row index of 
the result changes but the same additions are performed except for the clearance of the upper triangular matrix 
which docs not affect leading terms. □ 

This allows us to prove that i^4/5 indeed computes a Grobner basis if it terminates. 

Theorem 4.4. If F^/^ terminates and returns goj---jffr-i for the input {/o, • • • , /m-i} then g^, . . . ,g^_i is a 
Grobner basis for the ideal spanned by fo, . . . , fm-i where go, - ■ ■ ,gr-i /q, . . . , fm-i are homogeneous polyno- 
mials in ¥[xq, . . . ,x„_i]. 

Proof. Lemma 4.1 states that the general structure of the algorithm is correct; Lemma 4.3 states that the output 
of Gaussian ELiMiNATiONi?5 is not worse than the output of Gaussian elimination in F4 from a correctness 
perspective since all new leading monomials are included. Inspection of Algorithm 7 shows that it does return 
the set {f G F \ LM(/) ^ F} as required for correctness of F4-style algorithms. Lemma 4.2 states that the 
pairs discarded by Updatefs are not needed to compute a Grobner basis. The correctness of the discarding of 
reductors in Algorithm 9 also follows from Lemma 4.2. Thus, we conclude that i^4/5 computes a Grobner basis if 
it terminates. □ 

However, Theorem 4.4 does not imply that -^4/5 terminates for all inputs. We note however, that there are no known 
counter examples. The difficulty with proving termination is due to the fact that the set F might not contain all 
possible reductors since the routine Find Reductor might discard a reductor if it is rewritable. While Lemma 4.2 
shows that this discarding does not affect the correctness, it does not show that the algorithm terminates because 
elements might be added to G and P which have leading terms already in LM{{po\y{g) \ g G G}). 



5 Relationship to Ars' dissertation 

We briefly describe the differences between the algorithm outlined here and that in [Ars05]. We refer to the latter 

• Fb/Ars takes as input not only F, but also a function 5el to select critical pairs (cf. [Fau99]), whereas ^4/5 
always selects pairs according to lowest degree of the LCM. In this case, i^s/yi^s is more general, but note that 
the description of F4 in [Fau99] claims that the most efflcient method to select critical pairs is, in general, by 
lowest degree of the LCM. 

• -Fs/Ars uses two functions to update two lists of critical pairs: 

— Update 1 is used to estimate the degree of termination (more correctly translated the degree of regularity 
— degre de regularite) and relies on Buchberger's LCM criterion. The critical pairs computed here are 
stored in a set P, but are never used to compute any polynomials, only to estimate the degree of 
termination. 
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— Update2 is used to compute critical pairs that are used to generate polynomials, and is comparable to 
Updatefs here. In addition to the indices of two labelled polynomials and the set of indices of computed 
polynomials, Update2 requires the list of previously computed critical pairs, and the estimated degree 
of termination. It discards critical pairs whose signatures are top-reducible by polynomials of lower index 
(the F5 criterion), as well as those whose degrees are larger than the estimated degree of termination. 

— Naturally, one wonders whether the estimated degree of termination is correct. The degree is estimated 
in the following way: any critical pair that passes Buchbcrger's second criterion is added to P, and the 
degree of termination is estimated as the largest degree of a critical pair in P. 

The reason such a method might be necessary in general is that no proof of termination exists for the 
F5 algorithms, not even in special cases [Gas08]. The difficulty lies in the fact that F5 short-circuits 
many top-reductions in order to respect the criteria and the signatures (see Symbolic Preprocessing 
and Find Reductor). For various reasons, the redundant polynomials that result from this cannot be 
merely discarded — some of their critical pairs are not redundant — but applying Buchbcrger's second 
criterion should allow one to determine the point at which all critical pairs are redundant. 
Note that a similar method to determine a degree of termination is given in [EGPIO], and is proven in 
detail. Each method has advantages over the other (one is slightly faster; the other computes a lower 
degree), and F4/5 can be modified easily to work with either. 

• ^5 /Ars adds both components of S-polynomials to the list of polynomials scheduled for reduction by Gaussian 
elimination. ^"4/5 only adds the component with the bigger signature and relies on Symbolic Preprocess- 
ing's to find a reductor for the leading term. This potentially allows for a reductor which had more reductions 
applied to it already. 

Thus, the algorithms arc essentially equivalent. 



6 A Small Example Run of F4/5 

We consider the ideal {x^y — z'^t,xz^ — y'^t,yz^ — x^t^) e F32oo3[2;, y, with the degree reverse lexicographical 
monomial ordering. 

After the initialisation G contains three elements 

(eo, xz^ - y'^t), {ei,x^y - zh), (ea, j/z^ - x'^f) 

and P contains the three pairs 

{x^yz^,z'^, 1, xy, 0), {xyz^, x, 2, yz, 0), (x^yz^, x^, 2, z^, 1). 

At degree d = 5 the algorithm selects the pairs (x^yz^, z^, 1, xy, 0) and {xyz^, x, 2, yz, 0) of which both survive the 
F5 criteria. These generate two new labelled polynomials L3 = (xe2,xyz^ — x^i^) and L4 = (z^ei,x^yz^ — zHA). 
These reduce to y^zt — x^t^ and xy^t — z^t respectively and are returned by REDUCTiONi?5. 

At degree d = 6 the algorithm selects the pairs (x^yz'^, x^, 2, z^, 1) and (xy'^zt, x, 3, z, 4) of which only the pair 
{x^yz^, x^, 2, z^, 1) survives the criteria. This pair generates a new labelled polynomial L5 = (x^e2, xy^zt — .x^i^) 
which reduces to z^t — xH"^ and is returned by REDUCTiONi?5. 

At degree d = 7 the algorithm selects the critical pairs 

(xy^z^t, z^ 4, yh, 0), (xy^z^t, xz, 3, yH, 0), (x^y^zt, x^ 3, y^zt, 1), {xz^t, x, 5, zh, 0) 

of which (xy^z^t, z^, 4, y'^t, 0) and {xz^t,x,5, z^t,0) survive the F5 criteria. These pairs generate two new labelled 
polynomials Lg = {x^e2,xz^t - x^t^) and L7 = (z^'ei, xy^z^t - z^i). REDUCTiONi^s these reduce to x^t^ - z'^t^ 
and z^t — y^t^. However, REDUCTiONi?5 also returns a third polynomial in order to preserve signatures, that is 
Ls = (x2ze2,y42 - x'^zt'^). 

At degree d = 8 the algorithm selects the pair (yz^t, z^t, 2, y, 7) which survives the F^, criteria. This pair generates 
a new labelled polynomial Lg = {z^te2,yz^t — x'^z^t^) which reduces to y^t^ — xy'^zt'^. 

Then the algorithm terminates. 
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